TECH NEWS

How to Build an MCP Server That Checks npm Packages Before AI Installs Them

https://hackernoon.imgix.net/images/XJJdxU0vNOOwAWTAbTpxZ6VZmou1-9x83cyp.png

Build a remote MCP server on Cloudflare Workers with the 2026-07-28 spec and TypeScript SDK v2. It checks npm packages for typos, deprecation and known vulnerabilities before your AI installs them.

AI coding assistants are good at writing npm install lines. They're less good at knowing whether the package in that line is real, abandoned, or a trap.

I wanted my assistant to check before it suggests anything. So I built a small MCP server for it: two tools, running on Cloudflare Workers, using the new stateless MCP spec from July 2026. It's free to host and needs no API keys.

This post walks through the build. It also covers the parts that surprised me, and a few of them changed how the tools work.

What we're building

The server is called pkgscout. It exposes two tools:

  • inspect_package tells the model whether a package exists, its latest version, weekly downloads,...

Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE

Read more